node-forge is vulnerable to ASN.1 OID Integer Truncation

Description

MITRE-Formatted CVE Description An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.2
• Patched version(s): 1.3.2

References

• GHSA-65ch-62r8-g69g
• CVE-2025-66030
• CWE-190
• CAPEC-310
• OWASP 2021-A6

Related Issues

• node-forge has ASN.1 Unbounded Recursion - CVE-2025-66031
• authkit-nextjs may let session cookies be cached in CDNs - CVE-2025-64762
• @perfood/couch-auth may expose session tokens, passwords - CVE-2025-60794
• undici Denial of Service attack via bad certificate data - CVE-2025-47279

Tags:

npm

node-forge